The engine version I used for these error reports is 2.2.7 but they happen in trunk also. The data I'm using is Battle for Mandicor's trunk. The circumstances in which the crashes happen seem to vary (sometimes it even doesn't crash).

A common element is that they happen in the function AiRequestedTypeAllowed in ai/ai_resource.cpp

(Excess blabbering removed)
Here's a debugging function I put in the AiRequestedTypeAllowed: printf("Name: %s\n", type.Ident.c_str());
It said the culprit was the dwarven town hall. However, I don't know why it.

I have a theory now. The town hall crashes the game because it cannot be built by anyone. This was confirmed(?) when I put a button for it to be built and this time the game didn't crash when it reached AiRequestedTypeAllowed. However, there's just one small problem with my theory. City halls cannot be built by anyone either. Why don't they crash the game? Also, that's not really a solution since town halls are supposed to be upgraded from town centers, not built directly.